EP3800623A1 - Appareil, procédé de transmission de données et programme - Google Patents

Appareil, procédé de transmission de données et programme Download PDF

Info

Publication number
EP3800623A1
EP3800623A1 EP19871898.3A EP19871898A EP3800623A1 EP 3800623 A1 EP3800623 A1 EP 3800623A1 EP 19871898 A EP19871898 A EP 19871898A EP 3800623 A1 EP3800623 A1 EP 3800623A1
Authority
EP
European Patent Office
Prior art keywords
log
priority
data item
transmission
vehicle
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
EP19871898.3A
Other languages
German (de)
English (en)
Other versions
EP3800623A4 (fr
Inventor
Keita Hasegawa
Takuma KOYAMA
Yasushi Okano
Masashi Tanaka
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nippon Telegraph and Telephone Corp
Original Assignee
Nippon Telegraph and Telephone Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nippon Telegraph and Telephone Corp filed Critical Nippon Telegraph and Telephone Corp
Publication of EP3800623A1 publication Critical patent/EP3800623A1/fr
Publication of EP3800623A4 publication Critical patent/EP3800623A4/fr
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H04W4/44—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P] for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]

Definitions

  • the present invention relates to equipment (a device), a data transmission method, and a program.
  • ECUs Electronic Control Units
  • Non-Patent Document 1 e.g., Non-Patent Document 1
  • Non-Patent Document 1 " Development of Automotive Intrusion Detection and Protection Systems against cyber-attack” [online], Internet ⁇ URL:https://news.panasonic.com/jp/press/dat a/2017/10/jn171010-2/jn171010-2.html>
  • the present invention has been made in view of the above points, and has an object to reduce the communication load due to data generated in a device.
  • a device includes a first determination unit configured to determine, for each data item generated in a device, a priority upon transmitting said each data item to an information processing apparatus, based on one or more rules set in advance; a second determination unit configured to determine, for said each data item, whether or not it is necessary to transmit said each data item to the information processing apparatus, based on the priority determined for said each data item; and a transmission unit configured to transmit a data item to the information processing apparatus among data items generated in the device for a predetermined period of time, the data item being determined by the second determination unit that it is necessary to transmit the data item to the information processing apparatus.
  • the communication load due to data generated in a device can be reduced.
  • FIG. 1 is a diagram illustrating an example of a system configuration in an embodiment according to the present invention.
  • multiple vehicles 20 are automobiles (connected cars) connected to various types of servers (e.g., a monitoring server 10, a service providing server 30a, and a service providing server 30b) via a network N1 such as the Internet.
  • servers e.g., a monitoring server 10, a service providing server 30a, and a service providing server 30b
  • a network N1 such as the Internet.
  • each vehicle 20 is connected to the network N1 via a wireless network such as a mobile communication network, to communicate with the various servers.
  • the service providing server 30a, the service providing server 30b, and the like are one or more computers that provide predetermined services to the vehicles 20 or services based on information collected from the vehicles 20.
  • the service providing server 30a may provide telematics services.
  • the service providing server 30b may provide services based on data collected from the vehicles 20.
  • the monitoring server 10 is one or more computers to detect an occurrence of an anomaly in the vehicle 20, and to analyze the contents of the anomaly based on data transmitted (uploaded) from the vehicle 20.
  • An example of an anomaly is a cyber-attack or the like to the vehicle 20 via a network.
  • FIG. 2 is a diagram illustrating an example of a hardware configuration of the monitoring server 10 in an embodiment according to the present invention.
  • the monitoring server 10 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like, all of which are connected with one another via a bus B.
  • a program that implements processing on the monitoring server 10 is provided with a recording medium 101 such as a CD-ROM.
  • a recording medium 101 such as a CD-ROM.
  • the program is installed in the auxiliary storage device 102 from the recording medium 101 via the drive device 100.
  • installation of the program does not need to be executed from the recording medium 101, and may be downloaded from another computer via the network.
  • the auxiliary storage device 102 stores the installed programs, and stores necessary files, data, and the like.
  • the memory device 103 reads and stores the program from the auxiliary storage device 102 when receiving a start command of the program.
  • the CPU 104 executes functions related to the monitoring server 10 according to the program stored in the memory device 103.
  • the interface device 105 is used as an interface for connecting to the network.
  • FIG. 3 is a diagram illustrating an example of a hardware configuration of the vehicle 20 in an embodiment according to the present invention.
  • the vehicle 20 includes a communication device 210, an information subsystem 220, a control subsystem 230, a gateway 240, and the like.
  • the communication device 210 includes a communication module for connecting to the network N1, a communication module for communicating with the other vehicles 20 or devices on roads, a communication module for connecting to smartphones and the like via a wireless LAN or short-distance wireless communication, and the like.
  • the information subsystem 220 is a part to execute information processing according to the installed programs, and includes a CPU 221, a memory device 222, an auxiliary storage device 223, a display device 224, an input device 225, and the like.
  • the auxiliary storage device 223 stores the installed programs and various items of data used by the programs.
  • the memory device 222 reads and stores a program to be activated from the auxiliary storage device 223.
  • the CPU 221 executes functions related to the information subsystem 220 according to the program stored in the memory device 222.
  • the display device 224 displays a GUI (Graphical User Interface) or the like according to the program.
  • the input device 225 is constituted with operational parts such as buttons and a touch panel to be used for inputting various operation commands. Note that, for example, in-vehicle devices such as a car navigation system and a head unit of a car audio system are examples of the information subsystem 220.
  • the control subsystem 230 is a part to control the behavior of the vehicle 20, and includes multiple microcomputers 231 and the like for various types of control.
  • an ECU Electronic Control Unit
  • the gateway 240 is a gateway (e.g., CGW (Central Gateway)) for connecting the information subsystem 220 with the control subsystem 230.
  • the communication protocol handled in the information subsystem 220 is, for example, an IP protocol; and a communication protocol used for communication between the microcomputers 231 in the control subsystem 230 is a non-IP protocol specialized for control (e.g., CAN (Controller Area Network)). Therefore, the gateway 240 is provided to absorb differences between these communication protocols.
  • FIG. 4 is merely an example.
  • the hardware configuration of the vehicle 20 is not limited to any particular one, as long as the functions described later can be implemented.
  • FIG. 4 is a diagram illustrating an example of a functional configuration of the vehicle 20 and the monitoring server 10 in an embodiment according to the present invention.
  • the information subsystem 220 of the vehicle 20 includes a control log obtaining unit 251, a sensor log generation unit 252, an anomaly determination unit 253, a priority determination unit 254, a log processing unit 255, a transmission timing detection unit 256, a state checking unit 257, a transmission order determination unit 258, a log transmission unit 259, a rule receiver unit 260, and the like. These units are implemented by one or more programs installed in the information subsystem 220 that cause the CPU 221 to execute processing.
  • the information subsystem 220 also includes databases (storage unit) such as a priority rule DB 271, a priority threshold DB 272, a control log DB 273, a sensor log DB 274, and the like. These databases (storage unit) can be implemented by using, for example, the memory device 222 or the auxiliary storage device 223.
  • databases storage unit
  • These databases can be implemented by using, for example, the memory device 222 or the auxiliary storage device 223.
  • the control log obtaining unit 251 obtains a control log.
  • the control log corresponds to log data related to communication executed by the microcomputers 231 in the control subsystem 230.
  • the data of communication contents by itself may be used as the control log. Therefore, the control log is generated every time communication is executed by one of the microcomputers 231.
  • the contents of communication includes, for example, contents of control of the vehicle 20; information related to infotainment such as audio, car navigation, and the like; and communication related to displaying of indicators in the vehicle 20.
  • the sensor log generation unit 252 generates a sensor log.
  • the sensor log corresponds to log data that includes data (e.g., values measured by sensors) obtained from sensors arranged at various locations in the vehicle 20 (e.g., an accelerometer, a GPS (Global Positioning System) receiver, etc.). Obtainment of data from the sensors and generation of a sensor log based on the data are executed at timings such as at regular intervals or upon occurrences of particular events. The generation interval of the sensor log may be different for each sensor. Also, sensors from which sensor logs are generated may be part or all of the sensors installed in the vehicle 20.
  • the anomaly determination unit 253 determines the degree (level) of anomalousness of the vehicle 20, based on a control log and a sensor log. Specifically, the anomaly determination unit 253 calculates an index value representing the degree of anomalousness (hereafter, referred to as "anomaly score"). However, only the control log may be used for calculating the anomaly score.
  • the priority determination unit 254 determines the priorities for the control log and the sensor log (hereafter, simply referred to as the "log(s)" if not distinguished from each other) upon transmission to the monitoring server 10.
  • the priority is determined by applying (fitting) the contents of the log and the anomaly score calculated for the log to rules for determining the priority (hereafter, referred to as the "priority rules") stored in the priority rule DB 271.
  • the priority is expressed as a numerical value, and a greater value indicates a higher need for transmission to the monitoring server 10.
  • the log processing unit 255 For each log, the log processing unit 255 compares the priority determined for the log against a threshold value stored in the priority threshold DB 272, to determine whether or not it is necessary to save (and transmit to the monitoring server 10) the log. Once having determined that it is necessary to save the log, the log processing unit 255 saves (stores) the log in the control log DB 273 or the sensor log DB 274.
  • the transmission timing detection unit 256 detects an arrival of a timing to transmit (upload) logs (hereafter, referred to as the "transmission timing") stored in the control log DB 273 or the sensor log DB 274 to the monitoring server 10.
  • the state checking unit 257 confirms (checks) the state of the vehicle 20 at that time. For example, whether or not the vehicle 20 is in a traveling state (or in a stop state), the communication state of the communication device 210, and the like are confirmed.
  • the transmission order determination unit 258 determines the transmission order of logs stored in the control log DB 273 or the sensor log DB 274 between the previous transmission timing and the current transmission timing (hereafter, referred to as "transmission candidate logs") based on the respective priorities and the like of the logs.
  • logs may be transmitted without passing through the control log DB 273 and the sensor log DB 274.
  • a form in which the control log DB 273 and the sensor log DB 274 are not used may be adopted.
  • the log transmission unit 259 transmits the transmission candidate logs to the monitoring server 10 in order according to the transmission order.
  • the rule receiver unit 260 receives a request for changing a priority rule delivered from the monitoring server 10, to change (update) the priority rule DB 271 with respect to the priority rule included in the change request.
  • the monitoring server 10 includes a log receiver unit 11, a monitoring unit 12, a rule change unit 13, a rule transmission unit 14, and the like. These units are implemented by one or more programs installed in the monitoring server 10 causing the CPU 104 to execute processing.
  • the monitoring server 10 also uses databases (storage unit) such as a control log DB 15, a sensor log DB 16, and a priority rule DB 17. These databases (storage unit) can be implemented by using, for example, the auxiliary storage device 102 or a storage device that can be connected to the monitoring server 10 via a network.
  • the log receiver unit 11 receives a log transmitted (uploaded) from the vehicle 20, and stores the log in the control log DB 15 or the sensor log DB 16.
  • the monitoring unit 12 detects an occurrence or a likelihood of an occurrence of a cyber-attack on the vehicle 20, based on the logs and the like stored in the control log DB 15 or the sensor log DB 16. Once having detected an occurrence or a likelihood of an occurrence of a cyber-attack, the monitoring unit 12 requests the rule change unit 13 to change the priority rules.
  • the rule change unit 13 changes part or all of the priority rules stored in the priority rule DB 17. Note that the priority rule DB 17 stores all the priority rules distributed to the vehicles 20.
  • the rule transmission unit 14 distributes a change request that includes priority rules changed by the rule change unit 13 to the vehicles 20.
  • FIG. 5 is a flow chart illustrating an example of processing steps when a log is generated.
  • the anomaly determination unit 253 determines (calculates) the anomaly score for the target log at Step S102.
  • FIG. 6 is a diagram illustrating an example of a configuration of a log.
  • (1) illustrates an example of the control log.
  • the control log includes date and time, a vehicle ID, an element ID, Data[0], Data[1], Data[2], Data[3], Data[4],..., and so on (hereafter, referred to as "Data[]").
  • the date and time represent date and time when the control log was obtained (the date and time when a communication related to the control log was executed).
  • the vehicle ID is identification information on a vehicle 20.
  • the element ID is identification information on a component of the vehicle 20.
  • the element ID in the control log is identification information on a microcomputer 231 that executed the communication related to the control log.
  • Data[] represents data included in the communication.
  • values of respective parameters related to the control of the engine are the values of the respective elements of Data[].
  • Data[] may include not only the values of the respective parameters related to the control of the engine, but also data such as the checksum and counter.
  • the sensor log includes date and time, a vehicle ID, an element ID, and data specific to a sensor related to the sensor log.
  • the date and time are date and time when the sensor log was generated.
  • the vehicle ID is identification information on a vehicle 20.
  • the element ID is identification information on a sensor as the output source of the data related to the sensor log.
  • the sensor log in FIG. 6 is a sensor log based on data obtained from an acceleration sensor, and hence, includes Acc_X, Acc_Y, and Acc_Z as data specific to the acceleration sensor.
  • Acc_X, Acc_Y, and Acc_Z are acceleration in the X-axis direction, acceleration in the Y-axis direction, and acceleration in the Z-axis direction, respectively.
  • the anomaly score with respect to a target log can be determined (calculated) by using publicly-known techniques.
  • the anomaly score may be determined by inputting the target log into a trained model (e.g., a neural network) that receives a log as input, and outputs an anomaly score.
  • the anomaly score may be 0 or 1 indicating the presence or absence of an anomaly, or may be a value indicating the degree of anomalousness within a range from a minimum value (e.g., "0") to a maximum value (e.g., "1").
  • the anomaly score does not need to be determined using both the control log and the sensor log. For example, just one of the control log and the sensor log may be used for determining the anomaly score.
  • the priority determination unit 254 refers to the priority rule DB 271, to determine the priority of the target log.
  • FIG. 7 is a diagram illustrating an example of a configuration of the priority rule DB 271.
  • the priority rule DB 271 stores one or more priority rules for each element ID (i.e., for each of the microcomputers 231 and for each of the sensors).
  • the characteristics of logs are different depending on the respective microcomputers 231 and the respective sensors; therefore, priority rules can be set according to the respective characteristics.
  • One priority rule may be defined to output one numeric value indicating a priority. In this case, there may be a certain priority rule that discretely determines a priority by comparing the value of one of the items of the log against one or more threshold values.
  • a priority rule may also be defined that sets a priority to be greater than or equal to the threshold value at Step S104 only in the case where the vehicle ID is a specific value, or otherwise, sets the priority to be less than the threshold value at Step S104. In this way, the upload sources of logs can be limited to part of the vehicles 20.
  • a priority rule of increasing the priority may be set. Also, if the interval is less than the threshold value, a priority rule of not increasing the priority or decreasing the priority may be set.
  • incrementing the priority may be implemented by outputting a positive-valued priority
  • decreasing the priority may be implemented by outputting a negative-valued priority.
  • a priority rule of increasing the priority may be set if the value of one of the items of a log related to the microcomputer 231 or the sensor is out of the range of possible values in a normal state or if the outlierness from the range (the difference from the range) is greater than or equal to the threshold value.
  • a priority rule of increasing the priority may be set in the case where the anomaly score is greater than or equal to a threshold value.
  • each of the threshold values described above may be different for each microcomputer 231 and for each sensor.
  • the priority determination unit 254 may dynamically change the criteria for the priority (e.g., the threshold values described above, etc.) based on the priority rules depending on the state and the like of the vehicle 20.
  • a threshold value related to a priority rule of a log of a microcomputer 231 related to functions of safety, such as the acceleration, the angle of the steering, the tension of the seat belt, and the like of the vehicle 20 may be changed so as to make the priority more likely to be increased than in a low-speed traveling state.
  • a first threshold value in a high-speed traveling state (a state of the speed being greater than or equal to a certain value) and a second threshold value in a low-speed traveling state (a state of the speed being less than the certain value) may be set in advance, so as to select the threshold value to be applied to the priority rule depending on the traveling state.
  • a function may be defined that receives the speed as input, and outputs a threshold value.
  • a priority rule of increasing the priority of a log for the microcomputer 231 may be set for a certain period of time after an occurrence of update processing of the software.
  • a threshold of a priority rule set with respect to the microcomputer 231 may be dynamically changed so as to increase the priority.
  • the priority rule may be set to increase the priority of a log from which a value diverged or deviated from a value obtained in a log obtained under a normal condition, or a high anomaly score is obtained.
  • multiple priority rules can be set for each microcomputer 231 and each sensor, a priority rule of defining a method of combining multiple priority rules may be set for each microcomputer 231 and for each sensor.
  • the priority rule may be, for example, a rule of selecting a maximum value of the priority output by the multiple priority rules, or a rule of determining the priority by the total value, weighted average, or sum of products.
  • the priority rule may be a rule of calculating a final priority by a function that takes the priority rules as the arguments.
  • the log processing unit 255 compares the priority determined at Step S103 against a threshold stored in association with an element ID of the target log in the priority threshold DB 272. If the priority is less than the threshold value (YES at Step S104), at Step S106, the log processing unit 255 discards the target log. In other words, in this case, the target log is not saved in the control log DB 273 or the sensor log DB 274. This also means that the target log is not to be transmitted to the monitoring server 10. Note that as described above, the logs may be transmitted without passing through the control log DB 273 and the sensor log DB 274.
  • the log processing unit 255 saves the target log in the control log DB 273 or the sensor log DB 274.
  • the target log is saved in the control log DB 273.
  • the target log is saved in the sensor log DB 274.
  • the anomaly score determined at Step S102 and the priority determined at Step S103 are assigned to the target log.
  • FIG. 8 is a diagram illustrating an example of a configuration of the control log DB 273.
  • each record of the control log DB 273 includes the items of (1) in FIG. 6 , an anomaly score, a priority, and a turn in a transmission order.
  • the value of a turn in a transmission order of a log stored in the control log DB 273 after the last transmission timing is empty.
  • the transmission order is determined when logs are to be transmitted.
  • FIG. 9 is a diagram illustrating an example of a configuration of the sensor log DB 274.
  • each record of the sensor log DB 274 includes the items of (2) in FIG. 6 , an anomaly score, a priority, and a turn in a transmission order.
  • the value of a turn in a transmission order of a log stored in the control log DB 273 after the last transmission timing is empty, for the same reason as in the control log DB 273.
  • the format of a sensor log varies from sensor to sensor. For example, in the case of a sensor log of a GPS receiver, latitude, longitude, and the like are included. Therefore, the sensor log DB 274 may store sensor logs in different tables that are separated for the respective sensors (per element ID).
  • a log means data added with items of an anomaly score, a priority, and a turn in a transmission order.
  • the value of the anomaly score may be zero, or the item of the anomaly score may be set blank.
  • FIG. 10 is a flow chart illustrating an example of processing steps when transmitting logs to a monitoring server 10.
  • Step S202 and subsequent steps are executed.
  • the transmission of logs may be executed at regular intervals.
  • the transmission timing detection unit 256 detects an arrival of a transmission timing after a certain period of time has elapsed since the previous transmission of logs.
  • the transmission of a log may be executed in response to an occurrence of a specific log.
  • the transmission timing detection unit 256 detects an arrival of a transmission timing if the target log corresponds to a specific log.
  • a log having a very high anomaly score may be considered.
  • the transmission of logs may be executed every time a certain number of logs are saved.
  • the transmission timing detection unit 256 detects an arrival of a transmission timing when the total number of logs saved in the control log DB 273 or the sensor log DB 274 reaches a certain number after the previous transmission of logs.
  • the transmission of logs may be executed in response to an occurrence of a certain event (e.g., change in the communication scheme between the vehicle 20 and the monitoring server 10, etc.).
  • the transmission timing detection unit 256 detects an arrival of a transmission timing in response to an occurrence of a specific event.
  • the transmission of logs may be executed at two or more timings as described above, or the transmission of logs may be executed in response to a request for transmission from the monitoring server 10.
  • the state checking unit 257 checks the state of the vehicle 20 and the state of communication between the vehicle 20 (the communication device 210) and the monitoring server 10.
  • the state of the vehicle 20 includes, for example, a traveling state (e.g., traveling speed) of the vehicle 20 and the like.
  • the state of communication between the vehicle 20 and the monitoring server 10 includes, for example, the communication scheme, stability, throughput, and the like.
  • the stability may be evaluated in terms of, for example, variation of the throughput, loss rate of packets, and the like.
  • the communication scheme means a route on the network to be used for communication and a method of communication in the network.
  • the communication device 210 may have redundancy with respect to the communication scheme with the monitoring server 10.
  • the communication device 210 may be capable of maintaining the communication with the monitoring server 10 using another communication scheme. For example, if it is possible to connect to a mobile communication network via a smart terminal or the like of one of the occupants of the vehicle 20, the communication device 210 may establish a connection with the monitoring server 10 via the smart terminal.
  • the communication device 210 may be capable of communicating with a roadside unit, an ITS infrastructure, or the other vehicles 20.
  • the communication device 210 may establish a connection with the monitoring server 10 by using road-to-vehicle communication or inter-vehicle communication.
  • the transmission order determination unit 258 determines the transmission order of logs (transmission candidate logs) stored in the control log DB 273 or the sensor log DB 274 between the previous transmission timing and the current transmission timing.
  • the transmission order may be determined, for example, in descending order of the priority. In this case, a transmission candidate log having a higher priority has a prior turn in the transmission order.
  • the transmission order may be adjusted based on the state of the vehicle 20, such as the traveling state confirmed at Step S202. For example, if the vehicle speed is greater than or equal to a threshold value, a transmission candidate log of a microcomputer 231 related to the behavior of the vehicle 20 may be given a prior turn in the transmission order.
  • a transmission candidate log of the microcomputer 231 related to the telemetry may be given a prior turn in the transmission order. In this way, depending on the state of the vehicle 20, the transmission order of logs related to a particular microcomputer 231 or sensor may be changed.
  • Such an adjustment may be executed among a group of transmission candidate logs having the same priority, or may be executed beyond the range of a group of transmission candidate logs having the same priority.
  • the adjustment among a group of transmission candidate logs having the same priority means that among the group of transmission candidate logs having the same priority, a transmission candidate log of a microcomputer 231 related to the behavior the vehicle 20 is given a prior turn in the transmission order, or a microcomputer 231 related to the telemetry is given a prior turn in the transmission order.
  • the adjustment beyond the range of a group of transmission candidate logs having the same priority means, for example, to determine the transmission order in descending order of the priority after adding a predetermined value to the priority of a transmission candidate log of a microcomputer 231 related to the behavior of the vehicle 20 or a transmission candidate log of a microcomputer 231 related to the telemetry.
  • the predetermined value may be a value greater than or equal to the highest priority among the transmission candidate logs.
  • a transmission candidate log of a microcomputer 231 related to the behavior of the vehicle 20 or a transmission candidate log of a microcomputer 231 related to the telemetry may be given a relatively prioritized turn in the transmission order compared against the other logs.
  • each transmission candidate log is a transmission candidate log of a microcomputer 231 related to the behavior of the vehicle 20 or a transmission candidate log of a microcomputer 231 related to the telemetry can be determined based on the element ID of the transmission candidate log.
  • information representing the type of function of a microcomputer 231 or a sensor corresponding to the element ID may be stored in advance in the auxiliary storage device 223 or the like.
  • the log transmission unit 259 establishes communication between the communication device 210 and the monitoring server 10, by using one of the alternatives of the communication scheme confirmed at Step S202 (e.g., an alternative of the highest communication speed).
  • the log transmission unit 259 transmits each transmission candidate log to the monitoring server 10 in the order according to the transmission order determined at Step S203.
  • transmission candidate logs actually transmitted may be limited up to the M-th turn (where M ⁇ the number of transmission candidate logs) in the transmission order.
  • the logs to be transmitted may be limited to part of the transmission candidate logs.
  • the logs to be transmitted may be narrowed down.
  • the value of M described above may be changed depending on the communication state.
  • the value of M may be increased, or otherwise, the value of M may be decreased.
  • the value of M may be set to 0.
  • the logs to be transmitted may be narrowed down by setting only logs of particular microcomputers 231 or particular sensors as the logs to be transmitted, instead of based on the number of logs to be transmitted.
  • a transmission candidate log of a microcomputer 231 related to the behavior of the vehicle 20 or a transmission candidate log of a microcomputer 231 related to the telemetry is set to have a prior turn in the transmission order, only a transmission candidate log of the microcomputer 231 related to the vehicle 20 or a transmission candidate log of a microcomputer 231 related to the telemetry may be set as the log to be transmitted.
  • all transmission candidate logs may be set as the logs to be transmitted.
  • a transmission candidate log related to a particular microcomputer 231 or a sensor may be transmitted to the monitoring server 10 only in the case of being connected to an authenticated wireless AP or base station (i.e. only in the case where the safety of the communication path is secured). In this way, it may be attempted to reduce the likelihood of leakage of confidential information.
  • the log transmission unit 259 determines whether or not the transmission of the transmission candidate logs that are logs to be transmitted is completed successfully. For example, as in HTTP (HyperText Transfer Protocol), in the case where the transmission candidate log is transmitted using a communication scheme in which a response from the communication counterpart (the monitoring server 10) is expected, if a normal response from the monitoring server 10 is received, the transmission of the transmission candidate log may be determined to have been successfully completed. On the other hand, as in UDP (User Datagram Protocol), in the case where the transmission candidate log is transmitted using a communication scheme in which a response from the communication counterpart (the monitoring server 10) is not expected, upon completion of the transmission, the transmission of the transmission candidate log may be determined to have been successfully completed.
  • HTTP HyperText Transfer Protocol
  • UDP User Datagram Protocol
  • Step S204 communication with the monitoring server 10 may be established with a communication scheme different from the previous scheme.
  • the logs transmitted by the log transmission unit 259 are received by the log receiver unit 11 of the monitoring server 10.
  • the log receiver unit 11 saves a received log in the control log DB 15 if the log is a control log, or saves the log in the sensor log DB 16 if the log is a sensor log.
  • the configuration of the control log DB 15 may be similar to that of the control log DB 273 ( FIG. 8 ).
  • the configuration of the sensor log DB 16 may be similar to that of the sensor log DB 274 ( FIG. 9 ).
  • FIG. 11 is a flow chart illustrating an example of processing steps when changing a priority rule in response to a request from the monitoring server 10.
  • Step S301 the rule receiver unit 260 is waiting for a request for changing a priority rule from the monitoring server 10. If the rule receiver unit 260 receives a request for changing (YES at Step S301), Step S302 and subsequent steps are executed. For example, the monitoring server 10 transmits the request for changing the priority rule to the vehicles 20 at the following timing.
  • the monitoring unit 12 of the monitoring server 10 refers to a group of logs saved in the control log DB 15 or the sensor log DB 16 periodically, or every time a new log is saved in the control log DB 15 or the sensor log DB 16, to determine whether there is a likelihood of an occurrence of a large-scale anomaly (an anomaly spanning multiple vehicles 20) such as a cyber-attack.
  • the method of determining whether there is a likelihood of an occurrence of such an anomaly is not limited to a predetermined method. For example, it may be executed based on a trained model (such as a neural network), or may be executed by using any other publicly-known techniques.
  • the monitoring unit 12 may detect whether there is a likelihood of an occurrence of an anomaly such as a cyber-attack, based on information sources other than logs. For example, the monitoring unit 12 may detect an occurrence of a cyber-attack or a concern for such an occurrence by using a CERT (Computer Emergency Response Team) of a car company, an SOC (Security Operation Center) operated by another company, information on announcements from security vendors, and the like.
  • CERT Computer Emergency Response Team
  • SOC Security Operation Center
  • the monitoring unit 12 requests the rule change unit 13 to change the priority rule so as to increase the priority of the log related to the microcomputer 231.
  • the rule change unit 13 changes the priority rule related to the microcomputer 231 so as to have a higher priority than set previously.
  • the rule change unit 13 changes the contents of definition for each of the priority rules stored in association with the element ID of the microcomputer 231 in the priority rule DB 17, so as to have a higher priority than set previously output.
  • a threshold used in the priority rule may be changed.
  • a priority rule such as adding infinity to the priority may be added to the element ID of the microcomputer 231.
  • the rule transmission unit 14 distributes a change request that includes changed priority rules to the vehicles 20.
  • a vehicle 20 that has already received a cyber-attack may be excluded from the destinations of distribution of the change request.
  • a vehicle 20 that has already received a cyber-attack can be identified based on the vehicle ID of a log from which the likelihood of the server attack was detected.
  • the monitoring unit 12 requests the rule change unit 13 to change the priority rule so as to increase the priority of the log of the vehicles 20 corresponding to the type.
  • the rule change unit 13 changes the contents of definition for all or part of the priority rules related to the vehicle type, so as to output a higher priority than in set previously.
  • the rule transmission unit 14 distributes the change request that includes the changed priority rules to the vehicles 20 corresponding to the type.
  • the rule change unit 13 Conversely, in the case where the priority rule is not defined for each type of vehicle, the rule change unit 13 generates copies of all or part of the priority rules, and for the copies, changes the contents of definition so as to output a higher priority than in set previously.
  • the rule transmission unit 14 distributes the change request that includes the copies of the changed priority rules to the vehicles 20 corresponding to the type. Note that at this time, a vehicle 20 that has already received a cyber-attack may be excluded from the destinations of distribution of the change request.
  • the rule receiver unit 260 updates the priority rule DB 271 with the priority rules included in the received change request. Specifically, among the priority rules stored in priority rule DB 271, a priority rule including the same element ID as in a received priority rule is overwritten by the received priority rule.
  • Step S304 the rule receiver unit 260 transmits a notice of success to the monitoring server 10. If having failed to update the priority rule DB 271 (NO at Step S303), at Step S305, the rule receiver unit 260 transmits a notice of failure to the monitoring server 10.
  • the priority rules of each vehicle 20 can be changed based on a reason on the monitoring server 10 side. Therefore, logs stored in each vehicle 20 or logs transmitted from each vehicle 20 can be changed dynamically. As a result, for example, in the case where it is desirable to cause the monitoring unit 12 of the monitoring server 10 to use logs of a particular microcomputer 231 as training data for detecting an anomaly of the microcomputer 231, the likelihood of collecting logs of the microcomputer 231 can be increased.
  • a request for changing the priority rule from the monitoring server 10 may include a span of logs (periodic span) to which the priority rule after the change is applied.
  • the span may include periods in the past.
  • priority rules after the change may be applied to logs that have been logged prior to the change request.
  • the logs to be transmitted may be changed in response to a request for transmission of the logs from the monitoring server 10, by determining afresh the priority of the logs before the change request.
  • the present embodiment may be applied to any other devices having communication functions.
  • the present embodiment may be applied to devices such as robots in factories; sensors, audio devices, home appliances, communication terminals (smartphones, tablet terminals, etc.) located various places; and devices commonly called as IoT (Internet of Things) devices.
  • IoT Internet of Things
  • the priority is determined based on priority rules, and a log (transmission candidate log) that is determined necessary to be transmitted based on the priority is transmitted to the monitoring server 10. Therefore, the amount of logs to be transmitted can be reduced compared to the case of transmitting all logs to the monitoring server 10. As a result, the communication load due to a log (data) generated in the vehicle 20 (a device) can be reduced.
  • the transmission candidate logs are stored in the database, and the other logs are discarded. Therefore, the consumption of the memory area in the vehicle 20 can be reduced.
  • the transmission order is determined based on the priority, and each transmission candidate log is transmitted according to the transmission order. Therefore, a transmission candidate log having a high priority can be prioritized to be transmitted to the monitoring server 10.
  • a criterion for determining whether or not to transmit a log based on the priority is changed depending on the state of the vehicle 20. Therefore, the priority of each log (i.e., whether or not to save the log in the database) can be changed dynamically depending on the state of the vehicle 20.
  • a criterion for determining that the log is to be transmitted is changed depending on the state of the vehicle 20. Therefore, the logs transmitted to the monitoring server 10 may be changed depending on the state of the vehicle 20.
  • a priority rule can be changed in response to a request from the monitoring server 10. Therefore, the likelihood that a log required by the monitoring server 10 is determined as a log to be transmitted can be increased.
  • the vehicle 20 is an example of a device.
  • the monitoring server 10 is an example of an information processing apparatus.
  • the priority determination unit 254 is an example of a first determination unit.
  • the log processing unit 255 is an example of a second determination unit.
  • the log transmission unit 259 is an example of a transmission unit.
  • the control log DB 273 and the sensor log DB 274 are examples of a storage unit.
  • the transmission order determination unit 258 is an example of a determination unit.
  • the rule receiver unit 260 is an example of a change unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)
  • Small-Scale Networks (AREA)
  • Computer And Data Communications (AREA)
  • Traffic Control Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
EP19871898.3A 2018-10-11 2019-10-10 Appareil, procédé de transmission de données et programme Pending EP3800623A4 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2018192414 2018-10-11
PCT/JP2019/040113 WO2020075826A1 (fr) 2018-10-11 2019-10-10 Appareil, procédé de transmission de données et programme

Publications (2)

Publication Number Publication Date
EP3800623A1 true EP3800623A1 (fr) 2021-04-07
EP3800623A4 EP3800623A4 (fr) 2021-09-15

Family

ID=70163833

Family Applications (1)

Application Number Title Priority Date Filing Date
EP19871898.3A Pending EP3800623A4 (fr) 2018-10-11 2019-10-10 Appareil, procédé de transmission de données et programme

Country Status (5)

Country Link
US (1) US11528325B2 (fr)
EP (1) EP3800623A4 (fr)
JP (1) JPWO2020075826A1 (fr)
CN (1) CN112639909B (fr)
WO (1) WO2020075826A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11474889B2 (en) * 2020-06-17 2022-10-18 Denso Corporation Log transmission controller

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11700270B2 (en) * 2019-02-19 2023-07-11 The Aerospace Corporation Systems and methods for detecting a communication anomaly
JP7439668B2 (ja) 2020-07-13 2024-02-28 株式会社デンソー ログ送信制御装置
JP7439669B2 (ja) 2020-07-14 2024-02-28 株式会社デンソー ログ分析装置
JP7373803B2 (ja) * 2020-09-29 2023-11-06 パナソニックＩｐマネジメント株式会社 情報送信装置、サーバ、及び、情報送信方法
JP7478085B2 (ja) 2020-12-03 2024-05-02 フォルシアクラリオン・エレクトロニクス株式会社 車載セキュリティ装置、車両セキュリティシステム、および車両管理方法
US20230104010A1 (en) 2021-09-30 2023-04-06 Woven Alpha, Inc. Vehicle data collection system and method of using

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7616642B2 (en) * 2006-01-04 2009-11-10 Sap Ag Priority assignment and transmission of sensor data
US8200376B2 (en) * 2007-07-30 2012-06-12 Symvionics, Inc. Vehicle performance monitoring system with multi-level caching
JP2011012968A (ja) * 2009-06-30 2011-01-20 Hitachi Automotive Systems Ltd 車両情報処理方法および車両情報処理サーバ
JP2011022713A (ja) * 2009-07-14 2011-02-03 Sumitomo Electric Ind Ltd 通信システム、及び路側通信機
US9607447B2 (en) * 2015-03-31 2017-03-28 Honeywell International Inc. Automated transmission of aircraft anomalous incident data via preferred transmission modes
EP3399708B1 (fr) * 2015-12-28 2020-09-23 KDDI Corporation Dispositif de traitement d'informations, procédé de traitement d'informations, et programme
US10158534B2 (en) * 2016-07-05 2018-12-18 Hitachi, Ltd. Edge processing for data transmission
JP6443409B2 (ja) * 2016-08-08 2018-12-26 トヨタ自動車株式会社 送信要否判定装置及び進路計画システム
JP6701030B2 (ja) * 2016-08-25 2020-05-27 クラリオン株式会社 車載装置、ログ収集システム
JP6804239B2 (ja) * 2016-09-01 2020-12-23 キヤノンメディカルシステムズ株式会社 医用画像診断装置
JP2018033793A (ja) 2016-09-01 2018-03-08 日本ストライカー株式会社 インプラント用ゲージ及びインプラント用器具組立体
WO2018168531A1 (fr) * 2017-03-13 2018-09-20 マクセル株式会社 Dispositif d'affichage tête-haute
JP6805960B2 (ja) 2017-05-16 2020-12-23 王子ホールディングス株式会社 衛生用品の製造装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11474889B2 (en) * 2020-06-17 2022-10-18 Denso Corporation Log transmission controller

Also Published As

Publication number Publication date
WO2020075826A1 (fr) 2020-04-16
US20210368007A1 (en) 2021-11-25
JPWO2020075826A1 (ja) 2021-09-02
CN112639909A (zh) 2021-04-09
CN112639909B (zh) 2023-10-03
EP3800623A4 (fr) 2021-09-15
US11528325B2 (en) 2022-12-13

Similar Documents

Publication Publication Date Title
US11528325B2 (en) Prioritizing data using rules for transmission over network
US11380197B2 (en) Data analysis apparatus
EP3113529B1 (fr) Système et procédé de détection d'anomalie sur la base de durée dans un réseau de communication embarqué
KR102310252B1 (ko) 자동차 운전자 보조 시스템에 관련된 방법
EP3189501B1 (fr) Système d'informations de véhicule
EP3274845B1 (fr) Systèmes de sécurité et procédé d'identification d'auteur d'attaque dans un véhicule
JP7056752B2 (ja) 分析装置、分析システム、分析方法及びプログラム
US10880415B2 (en) Detecting device, gateway device, and detecting method
JPWO2019142458A1 (ja) 車両監視装置、不正検知サーバ、および、制御方法
US11178164B2 (en) Data analysis apparatus
US11962605B2 (en) Information processing apparatus, data analysis method and program
CN110324301A (zh) 生成用于阻止对车辆的计算机攻击的规则的系统和方法
US11863574B2 (en) Information processing apparatus, anomaly analysis method and program
Stachowski et al. An assessment method for automotive intrusion detection system performance
US11924726B2 (en) In-vehicle control device, information processing device, vehicle network system, method of providing application program, and recording medium with program recorded thereon
CN112590798B (zh) 用于检测驾驶员状态的方法、装置、电子设备和介质
US20230179570A1 (en) Canbus cybersecurity firewall
JP2024505423A (ja) 協調型高度道路交通システムのためのローカル誤動作防止システム
KR20150041234A (ko) 차량의 고장정보 처리 시스템 및 그 방법

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20201229

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

A4 Supplementary search report drawn up and despatched

Effective date: 20210818

RIC1 Information provided on ipc code assigned before grant

Ipc: H04W 12/122 20210101ALI20210812BHEP

Ipc: H04L 29/06 20060101ALI20210812BHEP

Ipc: H04L 12/70 20130101ALI20210812BHEP

Ipc: G06F 21/55 20130101ALI20210812BHEP

Ipc: G06F 13/00 20060101ALI20210812BHEP

Ipc: G08G 1/09 20060101AFI20210812BHEP

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20220819

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 9/40 20220101ALI20240301BHEP

Ipc: H04W 12/122 20210101ALI20240301BHEP

Ipc: G06F 21/55 20130101ALI20240301BHEP

Ipc: G06F 13/00 20060101ALI20240301BHEP

Ipc: G08G 1/09 20060101AFI20240301BHEP

INTG Intention to grant announced

Effective date: 20240409